Add supplementary groups lookup in sysinit

Fixes #3012

I'll file a new issue for the other issue/race I mentioned in my comments there.

Also, I'd like some comments/thought on whether the initial `return nil` in that `changeUser` function should be replaced with `args.user = strconv.Itoa(syscall.Getuid())`, so it can even work for our default "root" user properly.  I've got the change ready to go, and it works really awesome, but I figured that one's enough I ought to ask for comments before including it.